lkml.org 
[lkml]   [2022]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v36 06/33] LSM: Use lsmblob in security_audit_rule_match
    Date
    Change the secid parameter of security_audit_rule_match
    to a lsmblob structure pointer. Pass the entry from the
    lsmblob structure for the approprite slot to the LSM hook.

    Change the users of security_audit_rule_match to use the
    lsmblob instead of a u32. The scaffolding function lsmblob_init()
    fills the blob with the value of the old secid, ensuring that
    it is available to the appropriate module hook. The sources of
    the secid, security_task_getsecid() and security_inode_getsecid(),
    will be converted to use the blob structure later in the series.
    At the point the use of lsmblob_init() is dropped.

    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Cc: linux-audit@redhat.com
    ---
    include/linux/security.h | 5 +++--
    kernel/auditfilter.c | 6 ++++--
    kernel/auditsc.c | 16 +++++++++++-----
    security/security.c | 5 +++--
    4 files changed, 21 insertions(+), 11 deletions(-)

    diff --git a/include/linux/security.h b/include/linux/security.h
    index 5b0b2a596cee..95ba8c223e0c 100644
    --- a/include/linux/security.h
    +++ b/include/linux/security.h
    @@ -1957,7 +1957,7 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer)
    int security_audit_rule_init(u32 field, u32 op, char *rulestr,
    struct audit_lsm_rules *lsmrules);
    int security_audit_rule_known(struct audit_krule *krule);
    -int security_audit_rule_match(u32 secid, u32 field, u32 op,
    +int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
    struct audit_lsm_rules *lsmrules);
    void security_audit_rule_free(struct audit_lsm_rules *lsmrules);

    @@ -1974,7 +1974,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule)
    return 0;
    }

    -static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
    +static inline int security_audit_rule_match(struct lsmblob *blob,
    + u32 field, u32 op,
    struct audit_lsm_rules *lsmrules)
    {
    return 0;
    diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
    index de75bd6ad866..15cd4fe35e9c 100644
    --- a/kernel/auditfilter.c
    +++ b/kernel/auditfilter.c
    @@ -1337,6 +1337,7 @@ int audit_filter(int msgtype, unsigned int listtype)

    for (i = 0; i < e->rule.field_count; i++) {
    struct audit_field *f = &e->rule.fields[i];
    + struct lsmblob blob;
    pid_t pid;
    u32 sid;

    @@ -1369,8 +1370,9 @@ int audit_filter(int msgtype, unsigned int listtype)
    case AUDIT_SUBJ_CLR:
    if (f->lsm_str) {
    security_current_getsecid_subj(&sid);
    - result = security_audit_rule_match(sid,
    - f->type, f->op,
    + lsmblob_init(&blob, sid);
    + result = security_audit_rule_match(
    + &blob, f->type, f->op,
    &f->lsm_rules);
    }
    break;
    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index 1dcdf863adf6..7701dba499f5 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -468,6 +468,7 @@ static int audit_filter_rules(struct task_struct *tsk,
    const struct cred *cred;
    int i, need_sid = 1;
    u32 sid;
    + struct lsmblob blob;
    unsigned int sessionid;

    if (ctx && rule->prio <= ctx->prio)
    @@ -678,8 +679,10 @@ static int audit_filter_rules(struct task_struct *tsk,
    security_current_getsecid_subj(&sid);
    need_sid = 0;
    }
    - result = security_audit_rule_match(sid, f->type,
    - f->op, &f->lsm_rules);
    + lsmblob_init(&blob, sid);
    + result = security_audit_rule_match(&blob,
    + f->type, f->op,
    + &f->lsm_rules);
    }
    break;
    case AUDIT_OBJ_USER:
    @@ -692,15 +695,17 @@ static int audit_filter_rules(struct task_struct *tsk,
    if (f->lsm_str) {
    /* Find files that match */
    if (name) {
    + lsmblob_init(&blob, name->osid);
    result = security_audit_rule_match(
    - name->osid,
    + &blob,
    f->type,
    f->op,
    &f->lsm_rules);
    } else if (ctx) {
    list_for_each_entry(n, &ctx->names_list, list) {
    + lsmblob_init(&blob, n->osid);
    if (security_audit_rule_match(
    - n->osid, f->type, f->op,
    + &blob, f->type, f->op,
    &f->lsm_rules)) {
    ++result;
    break;
    @@ -710,7 +715,8 @@ static int audit_filter_rules(struct task_struct *tsk,
    /* Find ipc objects that match */
    if (!ctx || ctx->type != AUDIT_IPC)
    break;
    - if (security_audit_rule_match(ctx->ipc.osid,
    + lsmblob_init(&blob, ctx->ipc.osid);
    + if (security_audit_rule_match(&blob,
    f->type, f->op,
    &f->lsm_rules))
    ++result;
    diff --git a/security/security.c b/security/security.c
    index 141922732d10..ade59e3638e8 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -2697,7 +2697,7 @@ void security_audit_rule_free(struct audit_lsm_rules *lsmrules)
    }
    }

    -int security_audit_rule_match(u32 secid, u32 field, u32 op,
    +int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
    struct audit_lsm_rules *lsmrules)
    {
    struct security_hook_list *hp;
    @@ -2708,7 +2708,8 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op,
    continue;
    if (lsmrules->rule[hp->lsmid->slot] == NULL)
    continue;
    - rc = hp->hook.audit_rule_match(secid, field, op,
    + rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
    + field, op,
    &lsmrules->rule[hp->lsmid->slot]);
    if (rc)
    return rc;
    --
    2.35.1
    \
     
     \ /
      Last update: 2022-06-10 01:05    [W:4.102 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site